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MEMORANDUM FOR: Chief, Physical Security Division, OS 


FROM: 



Chief, Industrial 
Office of Security 


ecurity Branch, 


SUBJECT: 


ISB Universe 


Sir Donal : 

Recalleth your 2 November 1979 charge to: 

a. Define our universe 

b. Describe our target 

c. Accent reaudits 

Complieth we with a and b 

but nothing was done about category c; 

for research has shown 

that items unknown 

surfaced reasons for defying thee. 25X1 A 

Our universe was defined for us in February 1978 by the 
D/OS paper setting forth the Branch's mission. The primary 
mission then, as now, is to conduct periodic, unannounced com- 
prehensive security audits of Agency contractor facilities. 

To implement t hese a udits, we obtained from 0D6jE and OL a com- 
posite list of^^contractors involved with classified Agency 
contracts. These represent all of our audit possibilities but 
hardly our probabilities, as about^^^Jof the contractors on 
the list are very small and have classified contracts only be- HBHm 
cause Agency interest must be hidden. As the information is 
usually one or two sterilized contracts, for some reason classi- 
fied CONFIDENTIAL, it would be folly to attempt to audit all. 25X1 A 


25X 


WARNING NOTICE 

INTELLIG^rSftttBaEEor 
AND METHODS INVOLVED 


DERIVATIVE CL BY 
□ DECL El REVW ON 

Release 2002/01/09 : CIA-RDP96B01 1 CJiJL 





Approved For^ease 2002/01/09 : CIA-RDP96B01 17^0080004001 1-9 


25X1 A 


25X1 A 


25X1 A 


25X1 A 
25X1 A 


25X1 A 


Thus, our real world becomes more like ^^Bcontractors who have 
significant amounts of Agency informat J^^^hat requires pro- 
tection. This figure has been determined through the following 
research. 


researcn. 25X1A 

As you may recalleth, OL submitted a list of ^^Hcontractors 
to be audited and prioritized them "A" and "B." They used as the 
basis for their "A" prioritization 

a. Did the company have SI/TK as part of the contract 

b. Did they have a TS contract 

c. Did they have a long time relationship with the Agency 

f the above, they were rated 
were placed in this category. 

9 25X1 A 
contractors and prioritized them 
as the basis for their prioriti- 
zation, ^b^Tumb^^f SCI contracts at a company and the dc^^n" 
value, ^^^^^^■contractors were rat^^^tegory " 1 , " ^oAl A 
category^^/^an^^Hcategory "3." Since^^MD§E contrac^^ff^flso 
have contracts w^^^uL, we were provided m^(Pa total of^^^ftepa- 
rate contractors to audit. 25X1A 


After ISB had conducted about 85 audits, it became apparent25X1 A 
that most of the major companies had been audited. So in Aug|^^_ 
1979, we asked 0L and 0D$E to supply an up-to-date listing ofH| 
contractors they would lyc^to see audited during th^j^ct fiWfflP 
year. OL responded with^^^Jbut ODfjE only furnished|^^James ex- 
plaining that these repri^^Wed their remaining companies that 25X1A 
had not been audited. 

Recently ISB conducted audits at four priority "A” companies 
and found no active contracts. One of these companies was se- 
lected from the 0D§E list while the other three were from the 0L 
list. Prior to the audits, ISB personnel conducted thorough re- 
search which included interviews with cognizant Industrial Secu- 
rity Officers. The auditors left for the audits with the belief 
that there was at least one active contract at these firms. All 
they found were residuals. 

m a 'yiuK.e. 


Approved For Release 2002/01/09 : CIA-RDP96B01172R000800040011-9 




T7«00800040011-9 


Approved For ^^ease 2002/0T/C 


25X1 A 


25X1 A 


25X1 A 


25X1 A 



These experiences cast doubts on the validity' of the 
lists, and we had already audited all of those (except for|^_^ 
prioritized category "A" because of SI/TK or TS; the third cri- 
teria of OL, longevity, seemed to be the culprit. Before making 
any conclusions, however, an effort was made to ascertain if OL 
and OD§E had supplied us with a complete listing of companies 
that should be rated "A” by their own criteria. 

25X1 A 

OL was asked to supply a list contractors who had 

SI/TK. They responded with a list oJ^M^hich they advised was 
incomplete. Nevertheless there were on the list that had 

not been previously furnished. The Special Security Center also 
attempted to furnish a list of SI/TK- facilities by tasking their 
computers to come up with a listing of all Agency-sponsored SI/TK 
accesses ji industry. From this list we were able to develop the 
names of ^Mcompanies that had SI/TK facilities. These companies, 
however, either been audited by us in the past or appeared on 

other lists. Therefore, they were unable to furnish any addi- 
tional names. 


The latest COI^F computer printout was reviewed page by page. 
The printout lists BHLontractors with TS contracts that were not 
listed on the priorW^ lists previously furnished. It should be 
noted, however, that most are recent additions, and some have 
very small contracts. /^r or At HO- etHtt /'/(?& 

i ub&u on s.n> $/fc c- j-r wt Rtcntno 

Thus we have an addition of 38 companies that we can add to 
our priority listing from OL. 


25X1 A 

who assists in 

computer printout. He advised 
a special printout that would 


Contact was also made withl 
the preparation of the OD§E STEI 
that he would be able to furnish 

« ide a total alphabetical listing of all contractors in the 
world that were Agency connected, along with the status of 
contract, the dollar value, and the scheduled date of com- 
pletion. In the future, he will furnish this run on a quarterly 
basis. The initial run listed eight contractors not previously 
listed by OD£jE. 25X1A 


This research then has developed the names of 

n^to 


;ontractors 

who can be considered priority "A" without resorting to use of 
the "longevity" criteria. It seems to <&e that a far better cri- 
teria than longevity would be a criteria based on number of 
classified contracts and dollar value. The CON I'F run was reviewed 
page by page, and 15 new audit possibilities were discovered 
using this criteria. 

:y- ms r; op \mo & f / s Ae-rTtT/l 

th CM $■ Vfc-t US- 
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In view of the our auditable 

universe becomes about at we have already 9c; yia 

done plus approximate l^^^B!ew^^^?covSr?a companies), At-^^^*^ 
tached are 5 lists documeiffing research done to develop the m 
companies. 25X1 A 

Describe the Target: I believe ourj^iget is time limited. 

Now that we have developed a resdvoir of^^Jiew companies to 
audit, this should be sufficient to carry us to the next fiscal 
year, especially if, as planned, some reaudits will be injected. 
However, after that, most of the "significant Priority A" con- 
tractors will have been audited^^^feel strongly that we should 
not attempt to audit all of the ^Bis the small companies can / 
be very adequately checked throil^^^ispections by ISO's. There25X1A 
fore, it appears that during the next 9 months our targets will 
be contractors on our new priority lists plus periodic reaudits. 

After that our targets should be reaudits plus any new contrac- 
tors in the priority "A" category that may enter the scene. 

This should then put the reaudits on a 2-year-plus cycle. I 
feel this is acceptable, for to reaudit in less then 2 years 
would constitute harrassment. 

In the future, ISB will prepare all lists of contractors to 
be audited from our own research and will only rely on OL and ^ 
ODfjE to furnish us with companies they want audited for special 
reasons. Additionally, a general audit list will be prepared 
before each quarter and coordinated with OL and 0D§E. 

This coordination is essential to preclude going to com- 
panies just inspected by ISO's, going to companies where con- 
tracts have been recently cancelled, and to allow them to voice 
any operational objections they may have prior to the audit 
being set up for a specific audit date. 

I hopeth this prose has ^lightened thee 
regarding the future course of ISB, 
but if this falls short 

of an adequate report 25X1A 

someone else will revise it, not me! 
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